Docker and CI/CD · Senior · Question 62 of 75
What is dependency confusion?
- 1A lockfile lists dependencies in the wrong order
- 2Two versions of one package are loaded at the same time
- ✓Correct answer: A public package with your internal name gets installed
Explanation
If the resolver checks the public registry first or prefers higher versions, an attacker can publish your-internal-lib@99.0.0. Use scoped packages and pin registries per scope.